From 734cdf689295934a038c0304e048699823a30cb4 Mon Sep 17 00:00:00 2001 From: lilleman Date: Sat, 22 Aug 2026 14:21:14 +0200 Subject: [PATCH] Name the scope the overview actually needs --- README.md | 2 +- release-tooling/dockerhub-overview.ts | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index e2c8540..838ce49 100644 --- a/README.md +++ b/README.md @@ -1463,7 +1463,7 @@ the built-in Actions token wouldn't trigger it). `HOST_API_VERSION` is never tou | --- | --- | | `DOCKER_REGISTRY_USER` (var) + `DOCKER_REGISTRY_TOKEN` (secret) | A Gitea account with package write in the `larvit` org, and its access token with `read:package` + `write:package`. Reused by `registry-cleanup.yml`. | | `DOCKERHUB_USER` (var) + `DOCKERHUB_TOKEN` (secret) | The public `larvit/plainpages` Docker Hub repo, and a read/write token **scoped to that repository** (an org access token, or one on a dedicated account — an account-wide PAT can push to every repo under it). | -| `DOCKERHUB_OVERVIEW_TOKEN` (secret) | A Docker Hub PAT that may **edit repository metadata**, used only to publish the overview. Separate from `DOCKERHUB_TOKEN` so the image-push credential stays narrow; without it the `publish-overview` job fails and the released images are unaffected. | +| `DOCKERHUB_OVERVIEW_TOKEN` (secret) | A Docker Hub PAT with **read/write/delete** scope — editing the overview needs delete, pushing images does not. Kept separate so that scope never reaches `docker login`, which writes it to the runner's shared config; without it the `publish-overview` job fails and the released images are unaffected. | | `MIRROR_GITHUB_TOKEN` (secret) | A fine-grained PAT (Contents: read & write) for a GitHub machine account with write access to the mirror. Its `main` must not block force-pushes and must carry no tag protection, which would reject the prune. | | `RENOVATE_TOKEN` (secret) | The shared `renovate@larvit.se` bot's Gitea PAT, with write access to this repo. | | `RENOVATE_GITHUB_TOKEN` (secret) | A **scopeless** (read-only) github.com PAT, so Renovate's lookups of github.com-hosted deps run authenticated instead of tripping the anonymous 60-req/hour limit. | diff --git a/release-tooling/dockerhub-overview.ts b/release-tooling/dockerhub-overview.ts index 4dca3fe..24da29a 100644 --- a/release-tooling/dockerhub-overview.ts +++ b/release-tooling/dockerhub-overview.ts @@ -90,8 +90,8 @@ async function main(): Promise { return fail( `Docker Hub overview PATCH failed: ${res.status} ${res.text}` + (res.status === 403 - ? "\n403 means DOCKERHUB_OVERVIEW_TOKEN cannot edit repository metadata — a separate " + - "permission from pushing images, which is why it is its own secret (README -> CI/CD)." + ? "\n403 means DOCKERHUB_OVERVIEW_TOKEN lacks the delete scope — editing the overview needs " + + "read/write/delete, which pushing images does not (README -> CI/CD)." : ""), ); }